CVE-2023-54289

What it actually does

NULL pointer dereference in qedf_alloc_global_queues error path when qedf_free_global_queues is invoked before global_queues allocation completes, leading to crash on NULL gl pointer check.

Why it matters to the business

Kernel panic or denial of service on systems with QLogic FCoE adapters during driver initialization failures; low urgency given absence from exploitation lists and minimal EPSS score.

How an attack unfolds

An attacker with local access or ability to induce device probe errors can trigger the buggy error unwind in qedf_alloc_global_queues, causing the NULL dereference and system instability; no named threat actors or ransomware campaigns associated.

How to fix it

Apply the upstream fix commit 961c8370c5f7e80a267680476e1bcff34bffe71a or later stable kernel versions containing the corrected error handling in qedf_main.c; reboot after update and verify driver functionality.

How to confirm the fix worked

Confirm presence of commit 961c8370c5f7e80a267680476e1bcff34bffe71a in kernel source; test qedf module load under simulated allocation failure conditions to ensure no NULL dereference occurs.

Typical attack path

1. Trigger qedf driver load or device initialization that reaches allocation failure point
2. Invoke qedf_free_global_queues on uninitialized global_queues structure
3. Dereference NULL gl pointer inside the free function causing kernel oops

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for NULL pointer dereference oops mentioning qedf_alloc_global_queues or qedf_free_global_queues; correlate with FCoE adapter probe failures.

• qedf_alloc_global_queues
• qedf_free_global_queues
• drivers/scsi/qedf/qedf_main.c:3056
• missing unwind goto

What your security team should do

• Identify systems using qedf FCoE driver via lspci or lsmod
• Schedule kernel updates to include the referenced commit within standard patch cycles
• Monitor kernel logs for qedf-related oops during driver initialization as a temporary detection measure